From 94781fd11ac3f6f04b3f204b285c1ba030d196d8 Mon Sep 17 00:00:00 2001
From: Alexa <53471801+Alexa-RR@users.noreply.github.com>
Date: Sun, 25 Oct 2026 17:24:25 +0200
Subject: [PATCH] fix(auth): don't read the provider's userinfo endpoint by
 default

Cloudflare Access answers userinfo without a Content-Type, which the
OpenID Connect handler rejects ("Unknown response type"), so every
sign-in failed after the code exchange. The ID token already carries
sub and email; DorkNet:SignIn:UseUserInfoEndpoint turns the call back
on for providers that need it.
---
 DorkNet.Server/Services/ExternalSignIn.cs             | 6 ++++++
 DorkNet.Server/Startup/ServiceCollectionExtensions.cs | 2 +-
 docs/deploy.md                                        | 3 +++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/DorkNet.Server/Services/ExternalSignIn.cs b/DorkNet.Server/Services/ExternalSignIn.cs
index e2657b2..dda5ea5 100644
--- a/DorkNet.Server/Services/ExternalSignIn.cs
+++ b/DorkNet.Server/Services/ExternalSignIn.cs
@@ -26,6 +26,12 @@ public sealed class ExternalSignInOptions
 
     public string Scopes { get; set; } = "openid email profile";
 
+    /// <summary>Also read the provider's userinfo endpoint after sign-in. Off by
+    /// default: the ID token already carries <c>sub</c> and <c>email</c>, and
+    /// Cloudflare Access answers userinfo without a Content-Type, which the
+    /// OpenID Connect handler rejects.</summary>
+    public bool UseUserInfoEndpoint { get; set; }
+
     public bool IsConfigured =>
         Authority.Length > 0 && ClientId.Length > 0 && ClientSecret.Length > 0;
 }
diff --git a/DorkNet.Server/Startup/ServiceCollectionExtensions.cs b/DorkNet.Server/Startup/ServiceCollectionExtensions.cs
index 41e8405..38f3caa 100644
--- a/DorkNet.Server/Startup/ServiceCollectionExtensions.cs
+++ b/DorkNet.Server/Startup/ServiceCollectionExtensions.cs
@@ -484,7 +484,7 @@ public static class ServiceCollectionExtensions
                 o.Scope.Add(scope);
             o.SignInScheme = ExternalSignIn.ExternalScheme;
             o.CallbackPath = ExternalSignIn.CallbackPath;
-            o.GetClaimsFromUserInfoEndpoint = true;
+            o.GetClaimsFromUserInfoEndpoint = signIn.UseUserInfoEndpoint;
             o.MapInboundClaims = false;
             o.SaveTokens = false;
             o.CorrelationCookie.SecurePolicy = secure;
diff --git a/docs/deploy.md b/docs/deploy.md
index b025ccb..399f6e1 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -477,6 +477,9 @@ DorkNet__SignIn__ClientSecret=<client secret>
 DorkNet__SignIn__DisplayName=Cloudflare
 # Optional: scopes, default "openid email profile".
 DorkNet__SignIn__Scopes=openid email profile
+# Optional: also read the userinfo endpoint (default false; the ID token is
+# enough for most providers, and Cloudflare Access's userinfo can't be read).
+DorkNet__SignIn__UseUserInfoEndpoint=false
 ```
 
 Register these redirect URIs at the provider, one per host people sign in on: